When a single threat operation manages to vacuum up more than 110 million credentials from hundreds of thousands of enterprise-grade firewall devices, the cybersecurity community takes notice. That is precisely the scale of what researchers are now calling FortiBleed — a sprawling, methodical credential-harvesting campaign that has been quietly dismantling perimeter security across the globe since at least February 2026.
A Financially Motivated Actor with Industrial-Scale Ambition
Attribution analysis points to a Russian-speaking initial access broker (IAB) operating with clear financial motivations. Unlike state-sponsored actors focused on espionage or sabotage, IABs commoditize network access — harvesting credentials and selling that foothold to the highest bidder, often ransomware groups or other criminal enterprises. What distinguishes FortiBleed is not just its scope but its operational sophistication, suggesting a well-resourced group with considerable technical discipline.
The campaign has targeted more than 430,000 FortiGate firewall devices worldwide, making it one of the largest sustained attacks against a single firewall ecosystem in recent memory. The sheer volume of compromised systems underscores a troubling reality: organizations that treat firewall deployment as a one-time security investment — rather than an ongoing maintenance commitment — are leaving themselves dangerously exposed.
Breaking Down the Attack Chain
FortiBleed does not rely on a single clever trick. Instead, it employs a layered, multi-stage methodology that maximizes both reach and efficiency:
This pipeline approach — combining passive intelligence gathering with active exploitation and custom malware deployment — is characteristic of mature, professionalized cybercriminal operations rather than opportunistic attackers.
Why FortiGate? Why Now?
Fortinet's FortiGate platform is among the most widely deployed enterprise firewall solutions globally, protecting networks across critical infrastructure, healthcare, finance, and government sectors. Its ubiquity makes it an extraordinarily attractive target. A single successful exploitation technique or credential list can be reused against tens of thousands of organizations simultaneously.
The economics of targeting a dominant security platform are compelling: one method, one toolset, millions of potential victims. For an IAB, that calculus is irresistible.
Additionally, many organizations running FortiGate devices have historically been slow to apply firmware updates or rotate administrative credentials — particularly in environments where firewall changes carry significant change-management overhead. The FortiBleed actors appear acutely aware of this operational reality and have engineered their campaign to exploit it.
The IAB Ecosystem: Why This Matters Beyond FortiGate
Understanding the initial access broker model is critical to appreciating the downstream risk FortiBleed represents. IABs do not typically attack organizations themselves — they sell the keys to others who do. That means every compromised FortiGate device represents a potential future ransomware intrusion, data exfiltration event, or business email compromise incident for the purchasing threat actor.
With 110 million credentials harvested and hundreds of thousands of devices potentially compromised, the volume of access being offered on criminal markets could fuel secondary attack waves for months or years to come. Organizations affected by FortiBleed may not realize their exposure until a ransomware affiliate activates purchased credentials long after the initial breach.
What You Should Do
If your organization relies on FortiGate firewalls — or any perimeter security appliance — the FortiBleed campaign demands an immediate and comprehensive response. The following actions should be prioritized:
- Audit internet-facing management interfaces immediately. Management portals, SSL-VPN login pages, and administrative consoles should never be exposed to the public internet without strict access controls. Restrict access to known IP ranges wherever possible.
- Apply all pending firmware updates without delay. Ensure every FortiGate device in your environment is running the latest supported firmware version. Unpatched systems are the lowest-hanging fruit for campaigns like FortiBleed.
- Force a global credential rotation. Assume that any credentials associated with your FortiGate devices may be compromised. Rotate all administrative passwords, VPN credentials, and service account tokens immediately.
- Enable multi-factor authentication (MFA) on all access points. MFA dramatically reduces the efficacy of credential-stuffing and brute-force attacks, even when valid usernames and passwords have been exposed.
- Review authentication logs for anomalous activity. Look for signs of unusual login attempts, access from unexpected geographic locations, or authentication patterns inconsistent with normal operations. Indicators of compromise may already be present in your logs.
- Engage your threat intelligence provider. Request specific indicators of compromise (IOCs) associated with FortiBleed and feed them into your SIEM and EDR tooling immediately.
The Broader Lesson
FortiBleed is a stark reminder that perimeter security devices are themselves high-value targets — not simply protective barriers. Firewalls, VPN concentrators, and network appliances must be subjected to the same rigorous patch management, credential hygiene, and monitoring discipline applied to any other critical enterprise system. Treating them as a "set it and forget it" control is a security posture that financially motivated threat actors are actively and profitably exploiting.
The scale of this operation should serve as a wake-up call. IABs are becoming more sophisticated, more automated, and more targeted in their campaigns. Organizations that fail to maintain their perimeter devices with the same vigilance they apply to endpoints and cloud workloads will continue to find themselves on the wrong end of a credential marketplace transaction.
